I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only see and store these tokens (not the actual card numbers), which we then include in API requests sent to the processor to charge another month's worth of subscription.

My questions:

  • What's the best way to store these tokens?
  • What if my system is compromised and someone get their hands on the tokens?

closed as unclear what you're asking by forest, Steffen Ullrich, Xander, Teun Vink, Josef Dec 20 '18 at 14:20

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm not sure I'm understanding what is being asked. We would need a lot more information as to exactly how such tokens work to be able to answer this. – forest Dec 8 '18 at 9:15
  • 4
    The risk of compromise and thus the security requirements to protect this token depend on what can be done with the token, i.e. if it is only associated to the credit card and could be misused by a malicious merchant, if it is associated with merchant and credit card, if it is associated with merchant, credit card and a specific amount of money within a specific time etc. You payment provider should have these information and likely has also requirements of which level of protection and maybe even specific security measures are needed. In other words: ask your payment provider for details. – Steffen Ullrich Dec 8 '18 at 9:27
  • 1
    PCI-DSS supplement for tokenization. – John Wu Dec 8 '18 at 10:10
  • @forest I am asking generally. Though you are right, this question is very dependent on the service generating the tokens. – Dávid Szabó Dec 8 '18 at 16:26
  • @SteffenUllrich Yes, you are right! I'll definitely ask my payment provider. – Dávid Szabó Dec 8 '18 at 16:26

My payment processor supports recurring payments via "credit card tokens".

This means that when someone makes a purchase, either you or the customer will send their credit card to your processor, and the processor will hand you a token back. Unlike a credit card, that token cannot be taken somewhere else and used; it's only valid between you and your processor to represent this one customer. You do not store their credit card; you forget all about it, and use the token instead.

The processor holds on to the credit card number, and whenever you say "Charge this token," they use the card number to effect the charge.

The advantage of this system is that you are not responsible for securing PAN ("Primary Account Number") data, which simplifies your security and audit concerns. If you arrange for your customers to hand their card numbers directly to the processor, without handing them to you first, then you can greatly reduce your PCI scope and obligations.

What's the best way to store these tokens?

Usually, in a database. They don't require the same level of encryption and protection that you would have to use for PAN data, if that's what you're concerned about.

What if my system is compromised and someone get their hands on the tokens?

If someone steals your entire database of tokens, they can't use them to do anything. They're not good for anything except in the context of you sending them to your processor using your credentials, which will get noticed very quickly when customers see they're double billed. (And the only way to monetize that is if your "membership" site ships something valuable, like cases of wine, out to customers, and the attacker could intercept the shipment).

Not the answer you're looking for? Browse other questions tagged or ask your own question.